Transparent LAN Service Over Cable
Total Page:16
File Type:pdf, Size:1020Kb
Transparent LAN Service over Cable This document describes the Transparent LAN Service (TLS) over Cable feature, which enhances existing Wide Area Network (WAN) support to provide more flexible Managed Access for multiple Internet service provider (ISP) support over a hybrid fiber-coaxial (HFC) cable network. This feature allows service providers to create a Layer 2 tunnel by mapping an upstream service identifier (SID) to an IEEE 802.1Q Virtual Local Area Network (VLAN). Finding Feature Information Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/. An account on http:// www.cisco.com/ is not required. Contents • Hardware Compatibility Matrix for Cisco cBR Series Routers, page 2 • Prerequisites for Transparent LAN Service over Cable, page 2 • Restrictions for Transparent LAN Service over Cable, page 3 • Information About Transparent LAN Service over Cable, page 3 • How to Configure the Transparent LAN Service over Cable, page 6 • Configuration Examples for Transparent LAN Service over Cable, page 8 • Verifying the Transparent LAN Service over Cable Configuration, page 10 • Additional References, page 11 • Feature Information for Transparent LAN Service over Cable, page 12 Cisco Converged Broadband Routers Software Configuration Guide For DOCSIS 1 Transparent LAN Service over Cable Hardware Compatibility Matrix for Cisco cBR Series Routers Hardware Compatibility Matrix for Cisco cBR Series Routers Note The hardware components introduced in a given Cisco IOS-XE Release are supported in all subsequent releases unless otherwise specified. Table 1: Hardware Compatibility Matrix for the Cisco cBR Series Routers Cisco CMTS Platform Processor Engine Interface Cards Cisco cBR-8 Converged Cisco IOS-XE Release 3.15.0S Cisco IOS-XE Release 3.15.0S Broadband Router and Later Releases and Later Releases Cisco cBR-8 Supervisor: Cisco cBR-8 CCAP Line Cards: • PID—CBR-CCAP-SUP-160G • PID—CBR-LC-8D30-16U30 • PID—CBR-CCAP-SUP-60G1 • PID—CBR-LC-8D31-16U30 • PID—CBR-SUP-8X10G-PIC • PID—CBR-RF-PIC • PID—CBR-RF-PROT-PIC Cisco cBR-8 Downstream PHY Modules: • PID—CBR-D30-DS-MOD • PID—CBR-D31-DS-MOD Cisco cBR-8 Upstream PHY Modules: • PID—CBR-D30-US-MOD 1 Effective with Cisco IOS-XE Release 3.17.0S, CBR-CCAP-SUP-60G supports 8 cable line cards. The total traffic rate is limited to 60Gbps, the total number of downstream service flow is limited to 72268, and downstream unicast low-latency flow does not count against the limits. Prerequisites for Transparent LAN Service over Cable • You must know the hardware (MAC) addresses of the cable modems that are to be mapped to IEEE 802.1Q VLANs. • You must create a bridge group for each separate customer on the Layer 2 bridge aggregator, so that traffic from all of the Customer Premises Equipment (CPE) devices for the customer is grouped together into the same 802.1Q tunnel. Cisco Converged Broadband Routers Software Configuration Guide For DOCSIS 2 Transparent LAN Service over Cable Restrictions for Transparent LAN Service over Cable Restrictions for Transparent LAN Service over Cable • Configuring 802.1Q for a particular cable modem removes any previous cable modem configuration on the router. • We strongly recommend that TLS over Cable only be used when Baseline Privacy Interface (BPI) is enabled in the environment. If BPI is not enabled when using the TLS feature, traffic can flow between multiple virtual private networks (VPNs), and become vulnerable to denial-of-service attacks or snooping. We also recommend that remote networks be isolated with a gateway or firewall router when BPI is not enabled. When the TLS feature is used with Layer 2 VPNs, the participating cable modems must have the Baseline Privacy Interface security feature (BPI) enabled. Otherwise, the Cisco CMTS drops such Layer 2 traffic in the upstream or downstream. • Packets are mapped to their Layer 2 tunnel only on the basis of Layer 2 information (the cable modem’s MAC address and primary SID). Layer 3 services, such as access lists, IP address source-verify, and IP QoS, are not supported as packets are sent through the tunnel. • All traffic from a cable modem is mapped to the same Layer 2 tunnel. It is not possible to differentiate traffic from different customer premises equipment (CPE) devices behind the cable modem. • CPE learning is not available when using the Transparent LAN Service over Cable feature. When a cable modem is mapped to a Layer 2 tunnel, the show interface cable modem command shows that the IP addresses for its CPE devices are “unavailable.” • DOCSIS QoS is supported across the Layer 2 tunnel only on the primary SID. Traffic using secondary services uses the same Layer 2 tunnel as the primary SID. • The Spanning Tree Protocol (STP) cannot be used with devices (cable modems, their CPE devices, and the endpoint CPE devices) that are using this feature. In particular, Spanning Tree Protocol cannot be used between the VLAN bridge aggregator and the endpoint customer devices. • The following restrictions apply to Layer 2 tunnels over an Ethernet IEEE 802.1Q VLAN interface: ◦ IEEE 802.1Q tunnels are supported only on Ten Gigabit Ethernet interfaces. ◦ The Cisco CMTS router supports a maximum of 4095 VLAN IDs, but the switches acting as the bridge aggregator might support a lower number of VLAN IDs. If this is the case, the Cisco CMTS should be configured only for the maximum number of VLANs that are supported by the bridge aggregator switches. Information About Transparent LAN Service over Cable This section contains the following: Cisco Converged Broadband Routers Software Configuration Guide For DOCSIS 3 Transparent LAN Service over Cable Feature Overview Feature Overview The Transparent LAN Service over Cable feature enables service providers to provide Layer 2 tunnels for traffic to and from cable modems. This allows customers to create their own virtual local area network (VLAN) using any number of cable modems in multiple sites. On the Cisco CMTS, you map each cable modem (on the basis of its MAC address) to the appropriate VLAN. The CMTS then creates an internal database of this one-to-one mapping of cable modems to VLANs, and uses it to encapsulate packets for the appropriate VLAN. The CMTS encapsulates the CPE traffic from mapped cable modems using the following method: • IEEE 802.1Q Mapping—The cable modem’s MAC address is mapped to an IEEE 802.1Q VLAN on a specific Ten Gigabit Ethernet interface, so that all traffic from the cable modem is tagged with the specified VLAN ID. Traffic to and from this group of cable modems is bridged into a single logical network (the VLAN) by the bridge aggregator, creating a secure Virtual Private Network (VPN) for that particular group of cable modems. Traffic in one VLAN cannot be sent into another VLAN, unless specifically done so by an external router. The switch acting as the Layer 2 Bridge Aggregator uses the VLAN tagging to forward the traffic to the appropriate destination. This frees up service providers from needing to know the addressing, routing, and topological details of the customer’s network. Transparent LAN Service and Layer 2 Virtual Private Networks In addition, service providers can provide a Layer 2 VPN with only minimal configuration changes on the provider’s routers. The service subscriber does not need to make any changes to their private network or cable modems, nor does the service provider have to provide any special DOCSIS configuration files to enable this feature. For the TLS feature with Layer 2 VPNs: • When the TLS feature is used with Layer 2 VPNs, the participating cable modems must have the Baseline Privacy Interface security feature (BPI) enabled. Otherwise, the Cisco CMTS drops such Layer 2 traffic in the upstream or downstream. • Information about Customer Premises Equipment (CPE) does not display in the output of the show cable modem command. IEEE 802.1Q Mapping This section describes the mapping of cable modems to an IEEE 802.1Q VLAN, as it is available in the Transparent LAN Service over Cable feature: Overview The Transparent LAN Service over Cable feature enables service providers to provide Layer 2 tunnels over an Ethernet network, using IEEE 802.1Q standard tags. This allows customers to create their own virtual network using any number of cable modems in different sites. Cisco Converged Broadband Routers Software Configuration Guide For DOCSIS 4 Transparent LAN Service over Cable Benefits On the Cisco CMTS, you map each cable modem (on the basis of its MAC address) to the appropriate VLAN. The CMTS then creates an internal database of this one-to-one mapping of cable modems to VLANs, and uses it to encapsulate packets for the appropriate VLAN. The CMTS encapsulates the CPE traffic from mapped cable modems using VLAN tags, as defined in IEEE 802.1Q-1993, IEEE Standards for Local and Metropolitan Area Networks: Virtual Bridged Local Area Networks . The switch acting as the Layer 2 Bridge Aggregator uses the VLAN tagging to forward the packets to the appropriate destination. Traffic to and from this group of cable modems is bridged into a single logical network by the bridge aggregator, creating a secure Virtual Private Network (VPN) for that particular group of cable modems. Traffic in one VLAN cannot be sent into another VLAN, unless specifically done so by an external router.